PfBlockerNG
-
For what its worth - this is how mine is configured:
On an unrelated note: WAN is not an outbound interface.
-
Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?
For what its worth - this is how mine is configured:
Except the LAN should be the outbound normally
Looks ok to me, maybe tomorrow about 11pm EST I can help with teamviewer if you don't have right by then
-
Whoops - I must have accidentally toggled it. Fixed right now; will monitor.
-
Hi McFuzz,
These are IBlock lists. And they are in a range format. You need to select "gz" format. There is a chart below the URL entry section to indicate what each "Format" is for.
I think the issue is with the "Ads" list. I will be doing some debugging today but try to toggle that list "off" and change all IBlock to "gz" then run a "Force Reload".
If you see a "-" in the widget there are issues with pfctl and it's not going to block anything.
-
I would also recommend removing the Bogon list and using pfSense built-in Bogon settings in the "Advanced Tab" of the GUI.
-
Is it possible to use easy list (https://easylist-downloads.adblockplus.org/easylist.txt) to block ads? I tried putting it in IPv4 Format: Text, List action Deny Inbound, but it doesn't seem to work. Also, When I do Force update it says Download FAIL.
-
Obviously the lists have loaded fine and firewall rules have been made as well but… what am I missing here?
Hi McFuzz,
Seems the issue is with IBlock posting the following IP for Blocking
# List distributed by iblocklist.com
doclix.com:0.0.0.0-0.0.0.0
I have code to remove "0.0.0.0", but as this was in a range format, it was being converted to "0.0.0.0**/32**", so the existing code was removing the "0.0.0.0" but leaving behind "/32". This would cause pfctl to not load properly.
I see that IBlock has removed that entry in their Ads List. It should never have been there in the first place. >:(
I will post a fix to resolve this potential Issue.
You can manually delete the old Ads Files.
rm /var/db/pfblockerng/original/Ads*.*then Re-enable the "Ads" List and then run a "Force Reload".
-
Is it possible to use easy list
Not currently. That is a Domain Blocklist. pfBlockerNG is an IP Based Blocking solution. pfBNG v2.0 will have this functionality.
-
I have configured iBlock list under IPv4 to block in both directions I see the logs showing blocking however no updates for the widget, please see attached
-
I have configured iBlock list under IPv4 to block in both directions I see the logs showing blocking however no updates for the widget, please see attached
When you look at the System Logs: Firewall Logs in the GUI. Do these alerts have pfB_ in the Rule Column?
-
no I don't but i see the IP being blocked in both the pfblockerNG:Alerts and the Firewall Log
-
Clear the Firewall Log and start fresh. When you make Rule Changes, they can go out of Sync.
-
how do you show Rule column under system:firewall log?
System Logs: Settings:
Filter Descriptions and select "Display as Column"
Also make sure the logs are in reverse. First Checkbox at the top of the Settings page.
-
I still don't see the pfB_in under rules
-
OK I see it now, but still no update in widget
-
OK I see it now, but still no update in widget
Did you manually edit the pfBlockerNG Descriptions in the rules? the rules are auto-generated and need to start with "pfB_"
You should not need to edit the Descriptions as this will affect how the Widget reads the log files.
Edit:
If you uses "Alias" Type rules: make sure the Rule Description starts with "pfb_" Lowercase..There is a whole tech section in the IPv4/Alias tab, to describe how to do this.
-
not for the auto rule under the WAN interface, but for the manually added rule under the LAN I did add a description as by default it is blank.
update…
I deleted the manual rule and created an auto rule, now it works fine. thanks BBcan177 for a great package, what is the account to donate?
-
Manual rules are just fine as long as you RTFM and set the descriptions as required. The widget lacks paranormal skills, cannot match the hits unless the rules description is set properly.
-
I will be on that list to want to see it and test it bbcan..
-
I have to agree with doktornotor, most of the problems I'm seeing reported here could have been avoided by reading the instructions on each page. BB' worked hard to explain everything either above or below each choice. Example: "Headers" are required.
The 'Header' Field must be Unique
IE. A Blank "Header field" is not unique.
Read each page carefully and it will work. :)
